meta_id 3240375

On June 15, 2026, the Icelandic Government opened a consultation on a proposed regulation implementing two delegated European Commission regulations concerning the designation of critical third-party information and communications technology service providers in the financial sector. The proposed regulation implements delegated regulations (EU) 2024/1502 and (EU) 2024/1505, which establish detailed criteria for designating critical third parties under the Digital Operational Resilience Act for the Financial Sector (DORA), Regulation (EU) 2022/2554. Under DORA's oversight framework, critical third parties providing information and communications technology services that meet designation criteria—including cross-border service provision and potential systemic impact on financial stability, continuity, or service quality—fall under the supervision of the EFTA Surveillance Authority as the primary supervisor. The proposed regulation specifies conditions for third-party designation under this framework and establishes supervisory fee arrangements. The primary supervisor holds authority to conduct information requests, general investigations, on-site inspections, issue recommendations, and propose remedial measures. Critical third parties designated under the framework must cooperate in good faith with their primary supervisor and pay supervisory fees as determined under delegated regulation (EU) 2024/1505. The Icelandic Government notes that no Icelandic entities are currently expected to meet designation criteria in the near term. The proposed regulation implements these delegated regulations consistent with the two-pillar structure of the European Economic Area Agreement and is based on Articles 1 and 2 of the Digital Operational Resilience Act for the Financial Sector, Law No. 78/2025. The consultation period runs from June 15 to June 30, 2026. Responses can be submitted through the consultation portal, and submissions are published as they are received.